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CLAIMS 

1. A method of storing sensitive information in a system comprising 
two databases, the method comprising at least the steps of: 

receiving a storage request including the information to be stored 
5 and a first identifier for identifying an individual with whom the information to be 
stored is associated; 

characterized by 

generating (507) a second identifier in such a manner that its value 
does not depend on the first identifier; 
10 storing (508) the first identifier and the second identifier in the first 

database in such a manner that the first identifier is bound to the second identi- 
fier; and 

storing the information to be stored in the second database together ' 
with the second identifier. 
15 2. A method as claimed in claim ^characterized by further 

comprising the steps of: 

checking (505), before generating the second identifier, in the first 
database if a second identifier is generated for the first identifier; 

if so, using the second identifier in the first database; and 
20 if not, generating the second identifier. 

3. A method as claimed in claim 1 or 2, characterized by 
further comprising the steps of: 

receiving a retrieval request including the first identifier; 
retrieving the second identifier corresponding to the first identifier 
25 from the first database; and 

retrieving the requested information from the second database using 
the second identifier. 

4. A method as claimed in claim 3, characterized by further 
comprising the step of sending, to the request, a response including the re- 

30 quested information and the first identifier. 

5. A telecommunication server (12, 22) in a data system comprising 
at least two databases and a system for generating information to be stored, 
the telecommunication server comprising 

reception means (121) for receiving a request, the request including 
35 the information to be stored and a first identifier for identifying an individual 
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with whom the information to be stored is associated; 

characterized in that the telecommunication server (12, 22) 
further comprises 

first processing means (122) for determining a second identifier cor- 
5 responding to the first identifier in the first database of the data system, the 
second identifier being generated in such a manner that its value does not de- 
pend on the first identifier; and 

second processing means (122) for storing the information to be 
stored together with the second identifier in the second database of the data 
10 system. 

6. A telecommunication server (12, 22) as claimed in claim 5, 
characterized in that 

the reception means (121) are also arranged to receive a data re- 
trieval request and to separate it from the storage request; and 
15 the second processing means (122) are also arranged to retrieve 

the data stored together with the second identifier from the second database of 
the data system in response to the data retrieval request and to forward the 
retrieved data without the second identifier to the party making the data re- 
trieval request. 

20 7. A telecommunication server (12, 22) in a data system comprising 

at least two databases and a system comprising stored data, the telecommuni- 
cation server comprising 

reception means (121) for receiving a request, the request being 
associated with the stored data and including a first identifier for identifying an 
25 individual with whom the stored data is associated; 

characterized in that the telecommunication server further 

comprises 

first processing means (122) for determining a second identifier cor- 
responding to the first identifier in the first database of the data system, the 
30 second identifier being generated in such a manner that its value does not de- 
pend on the first identifier; and 

second processing means (122) for retrieving the stored data to- 
gether with the second identifier from the second database of the data system. 
8. A network node comprising 
35 a database (DB1 ) for storing data, and 

reception means (31) for receiving a request directed to the data- 
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base and for separating a first identifier in the request, the first identifier identi- 
fying an individual with whom the data to be stored is associated; 

characterized in that the network node further comprises 
generation means (32) for generating a second identifier for the first 
5 identifier in such a manner that the value of the second identifier does not de- 
pend on the first identifier; 

storage means (32) for storing the first identifier and the second 
identifier in the database in such a manner that the first identifier is bound to 
the second identifier; and 
10 response means (31) for returning the second identifier in response 

to the request. 

9. A network node as claimed in claim 8, characterized in 

that 

it further comprises processing means (32) for checking if the data- 
15 base comprises a second identifier for the first identifier, and, if not, to trigger 
the generation means; and 

the generation means (32) are configured to be responsive to the 
processing means. 

10. A data system comprising 

20 at least one telecommunication server (12, 22) 

at least two databases (DB1 , DB2) 
characterized in that 

the first database (DB1) comprises records wherein a first identifier 
identifying an individual is linked to at least one second identifier, which alone 

25 does not identify the individual and whose value is generated in such a manner 
that it does not depend on the first identifier; 

the second database (DB2) comprises sensitive information stored 
in such a manner that each piece of personal information is bound to the cor- 
responding second identifier; and 

30 the telecommunication server (12, 22) is arranged to determine a 

second identifier corresponding to the first identifier in the database in re- 
sponse to a request including the first identifier, to delete the first identifier from 
the request, to add the second identifier to the request and then to send the 
request to the second database. 

35 



